/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

8 votes138 views1 answer
How to transpile typescript to javascript
Shell/Bash
0 vote218 views1 answer
How to install deface makers for ubuntu
Shell/Bash
0 vote170 views1 answer
Aexprot bash varible to another script
Shell/Bash
1 vote181 views2 answers
Htop
Shell/Bash
0 vote237 views1 answer
Cambiar nombre branch git
Shell/Bash
1 vote219 views1 answer
Install gnome sushi
Shell/Bash
1 vote209 views1 answer
Ip address in variable
Shell/Bash
1 vote195 views2 answers
Upgrading composer globally on windows
Shell/Bash
3 votes204 views3 answers
Install windows service
Shell/Bash
0 vote173 views1 answer
How to print cpu usage of threads in process ubuntu
Shell/Bash